From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8C386C433DB for ; Fri, 15 Jan 2021 12:51:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 56485221F7 for ; Fri, 15 Jan 2021 12:51:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387753AbhAOMfw (ORCPT ); Fri, 15 Jan 2021 07:35:52 -0500 Received: from mail.kernel.org ([198.145.29.99]:42222 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731983AbhAOMfr (ORCPT ); Fri, 15 Jan 2021 07:35:47 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 65464221FA; Fri, 15 Jan 2021 12:35:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1610714131; bh=Vokdy7CPJ1s6Q5gBU9BWmbfUgah+fdIFlIN7+nHC5y0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JbGkzi+E2h984prr5JvPhgHGV2voHuUdRoW/1FMpsJPfMJ2kfJ/U8x2lzwE8CBEeP /6eTZcYC0mNzdcz1EbV/M+K55U2XgPcmQuKfRLl8XKZtv2NgyAK0Ir8WXqGJk9zku+ nUvTcziu72RYQXBcyUYyc8nviMJ/3AHGFgoVFX8U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+7010af67ced6105e5ab6@syzkaller.appspotmail.com, Vasily Averin , Willem de Bruijn , Jakub Kicinski Subject: [PATCH 5.4 61/62] net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of trimmed packet Date: Fri, 15 Jan 2021 13:28:23 +0100 Message-Id: <20210115122001.337957379@linuxfoundation.org> X-Mailer: git-send-email 2.30.0 In-Reply-To: <20210115121958.391610178@linuxfoundation.org> References: <20210115121958.391610178@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Vasily Averin commit 54970a2fbb673f090b7f02d7f57b10b2e0707155 upstream. syzbot reproduces BUG_ON in skb_checksum_help(): tun creates (bogus) skb with huge partial-checksummed area and small ip packet inside. Then ip_rcv trims the skb based on size of internal ip packet, after that csum offset points beyond of trimmed skb. Then checksum_tg() called via netfilter hook triggers BUG_ON: offset = skb_checksum_start_offset(skb); BUG_ON(offset >= skb_headlen(skb)); To work around the problem this patch forces pskb_trim_rcsum_slow() to return -EINVAL in described scenario. It allows its callers to drop such kind of packets. Link: https://syzkaller.appspot.com/bug?id=b419a5ca95062664fe1a60b764621eb4526e2cd0 Reported-by: syzbot+7010af67ced6105e5ab6@syzkaller.appspotmail.com Signed-off-by: Vasily Averin Acked-by: Willem de Bruijn Link: https://lore.kernel.org/r/1b2494af-2c56-8ee2-7bc0-923fcad1cdf8@virtuozzo.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/core/skbuff.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2017,6 +2017,12 @@ int pskb_trim_rcsum_slow(struct sk_buff skb->csum = csum_block_sub(skb->csum, skb_checksum(skb, len, delta, 0), len); + } else if (skb->ip_summed == CHECKSUM_PARTIAL) { + int hdlen = (len > skb_headlen(skb)) ? skb_headlen(skb) : len; + int offset = skb_checksum_start_offset(skb) + skb->csum_offset; + + if (offset + sizeof(__sum16) > hdlen) + return -EINVAL; } return __pskb_trim(skb, len); }